Install Arctic Wolf Agent on Windows using Microsoft System Center Configuration Manager

You can use Microsoft System Center Configuration Manager (SCCM) to manage the deployment of Arctic Wolf® Agent.

Note:

  • Agent is designed to maintain a minimal footprint on all systems, but Arctic Wolf recommends some OS requirements. Arctic Wolf cannot guarantee functionality on virtual machine (VM) environments if resources do not meet recommended levels.

  • Agent does not support ARM architecture.

  • Windows 8.1, 8, 7, and Windows Server 2008 R2 are only supported on Agent version 2023-02_138.
  • Arctic Wolf recommends that you only use SCCM for the initial deployment of Agent, and not for updating Agent.

These resources are required:

  • To correctly view Agent risks in the Unified Portal, Windows Agent version 2023-02_138 or later is required

  • Administrator permissions or the ability to do administrator or root level functions

  • Your customer UUID.

    To find this value, in the Arctic Wolf Unified Portal, click Resources > Downloads, and then, in the Arctic Wolf Agent section, copy the Your Customer UUID value.

  • Your regional DNS hostname.

    To find this value, in the Arctic Wolf Unified Portal, click Resources > Allowlist Requirements, and then, in the Agent section, copy the DNS hostname that begins with activate.agent-common.prod.

  • One of these operating systems:
    • Windows 11 for 64-bit systems
    • Windows 10 Pro for 64-bit and 32-bit systems
    • Windows Server 2025, 2022, 2019, 2016, 2012 R2, or 2012 for 64-bit systems
    • Windows 11 IoT or Windows 10 IoT for 64-bit systems

    • If you plan to use Sysmon with Agent, Sysmon has these operating system requirements:

      • Windows 10 or newer for 64- and 32-bit systems
      • Windows Server 2016 or newer for 64-bit systems
  • These system resources:
    • A x64 or x86 processor
    • At a minimum:
      • A dual-core CPU
      • 2 GB of memory
      • 50 MB of disk space

These actions are required:

  • Confirm the installation location. Install Agent on the same drive as your ProgramFilesFolder, such as Program Files or Program Files (x86). This is usually the C:\.

  • Make sure outbound access is available for ports 443 and 1514.

Configure your environment firewall

Configure your firewall to allow traffic to Agent DNS hostnames.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Resources > Allowlist Requirements.
  3. Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.
    Note:

    Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

Add Agent processes to the allowlist

If you install Agent and an antivirus, endpoint scanner, Endpoint Detection and Response (EDR) solution, Unified Threat Management (UTM) solution, or similar software, add Agent processes to the allowlist in those applications to maintain stable CPU and memory utilization:

  1. Configure your security systems to allow the processes listed in Arctic Wolf Agent processes.
    Tip:
    Arctic Wolf recommends that you define a security rule or policy exclusion for the parent folder. Then, if new processes are added during a future Agent software update, the new rule or policy exclusion applies to it. For example, for a Windows endpoint, define a rule that applies to one of these file paths based on your Windows operating system (OS):

    • Windows 64-bit OS — C:\Program Files (x86)\Arctic Wolf Networks\

    • Windows 32-bit OS — C:\Program Files\Arctic Wolf Networks\

  2. Add the files listed in Arctic Wolf Agent hash values to all allowlists.
  3. If you use an EDR solution, verify that your EDR configuration changes are applied to all endpoints.

See the technical documentation for the security systems that you are configuring for more information.

Trust Agent scanner signed files

You must trust Agent scanner signed files to ensure Agent vulnerability and benchmark scanning is not impacted by other endpoint security tools installed on the endpoint.

If you partnered with Arctic Wolf as a Managed Risk customer before December 11, 2025, your vulnerability and benchmark scanning uses the PowerShell console by default. Scans fail if the console usage is blocked by endpoint security tools.

As of December 11, 2025, Arctic Wolf uses signed PowerShell scripts by default. Do one of these actions to ensure successful scans:

Enable VBScript

VBScript must be enabled to install Arctic Wolf Agent.

If you have disabled VBScript, you must re-enable this Windows feature.
  1. Go to Start > Settings > System > Optional features.
  2. Select View features.
  3. In the search dialog, enter VBSCRIPT, and then select the check box for the VBScript search result.
  4. To enable the VBScript feature, click Next.

Install Arctic Wolf Agent using SCCM

  1. Download the Agent MSI file, and then save it in a file share location.
  2. Sign in to the SCCM console.
  3. Click Software Library > Application Management > Applications.
  4. Right-click Applications, and then click Create an Application.
  5. Configure these settings:
    • Type — Click Windows Installer (*.msi file).
    • Location — Click Browse, and then navigate to the MSI installation file.
  6. Click Next.
  7. On the View imported information page, click Next.
  8. On the General Information page, in the Installation program field, enter this command:
    SHELL 
    msiexec /i <downloaded_filename.msi> /qn CUSTOMER_UUID=<customer_UUID> REGISTER_DNS=<regional_DNS>  /l*v scout_install.log

    Where:

    • downloaded_filename.msi is the filename of the Agent MSI file.
    • customer_UUID is your customer UUID. For more information, see Prerequisites.
    • regional_DNS is your regional DNS hostname. For more information, see Prerequisites.
  9. In the Install behavior field, select Install for System.
  10. Click Next.
  11. On the Summary page, click Next to complete the configuration.

Deploy Arctic Wolf Agent using SCCM

  1. In to the SCCM console, click Software Library > Application Management > Applications.
  2. Right-click the Agent application, and then click Deploy.
  3. In the Collection section, in the list, select one or more User Collections.
  4. Click OK.
  5. Click Next.
  6. On the Content page, click Add > Distribution Point.
  7. Select the distribution point where you installed the Agent MSI file, and then click OK.
  8. Click Next.
  9. On the Deployment Settings page, configure these settings:
    • Action — Click Install.
    • Purpose — Click Required.
  10. Click Next.
  11. On the Scheduling page, click Installation deadline > As soon as possible.
  12. Click Next.

Monitor Arctic Wolf Agent SCCM Installation

  1. Sign in to the Configuration Manager console.
  2. Click Monitoring > Deployments.
  3. Right-click the Agent deployment, and click View Status.

    The Status Type changes to Success when the deployment has successfully completed.

    Note:

    The time to complete the deployment varies based on the selected User Collections.

  4. Optional: Verify that Agent is installed on the target computer:
    1. Open Control Panel > Programs and Features.
    2. Verify that Agent is listed.